Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes F1Data Protection Act 1998 1998 CHAPTER 29 An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. [16th July 1998] Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:— Textual Amendments F1 Act repealed (except s. 62, Sch. 15 paras. 13, 15, 16, 18, 19) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 44 (with ss. 117, 209, 210, Sch. 20 paras. 2-9, 17-25, 27-46, 53, 54, 58); S.I. 2018/625, reg. 2(1)(g) Modifications etc. (not altering text) C1 Act modified (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 432 (with ss. 117, 209, 210, Sch. 20 paras. 58, 59); S.I. 2018/625, reg. 2(1)(g) C2 Act: power to amend conferred (8.5.2008) by virtue of Criminal Justice and Immigration Act 2008 (c. 4), ss. 77(5), 153 Act: Crown status for the purposes of the Act extended (6.5.1999) by S.I. 1999/677, art. 7(3) Act applied (1.4.2000) by 1999 c. 28, s. 19(2) (with s. 38); S.I. 2000/1066, art. 2 Act excluded (1.3.2000) by S.I. 2000/416, art. 2, Sch. Act: functions of the Secretary of State transferred to the Lord Chancellor (26.11.2001) by S.I. 2001/3500, arts. 3, 4, Sch. 1 para. 11 Act applied by S.I. 1993/1813, art. 4(2) (as substituted by S.I. 2001/1544, art. 3(5)(6)) (the amendment coming into force in accordance with art. 1(2) of S.I. 2001/1544) Act (except ss. 6(4)(a)(b), 28, Sch. 5 para. 12(2) for certain purposes and Sch. 6 paras. 2, 3): functions of the Lord Chancellor transferred to the Secretary of State, and all property, rights and liabilities to which the Lord Chancellor is entitled or subject to in connection with any such function transferred to the Secretary of State for Constitutional Affairs (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), arts. 4, 5, Sch. 1 (with art. 6) 2 Data Protection Act 1998 (c. 29) Part I – Preliminary Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes Act restricted by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 8(2) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act modified by The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818), art. 11(4) (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act modified by The National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118), art. 5 (the amendment coming into force in accordance with art. 1(2) of the amending S.I.) Act excluded (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 50(1) Act applied (N.I.) (12.4.2016) by Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12), s. 1(8) Act applied (S.) (1.4.2018) by The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66), reg. 1, sch. 6 para. 64 (with reg. 2) C3 Act applied in part (with modifications) in so far as still in force by S.I. 2003/2426, Sch. 1 para. 8AA (as amended) (17.12.2018) by The Privacy and Electronic Communications (Amendment) Regulations 2018 (S.I. 2018/1189), regs. 1, 2(2)(3) F1 PART I PRELIMINARY 1 Basic interpretative provisions. 2 Sensitive personal data. 3 The special purposes. 4 The data protection principles. 5 Application of Act. 6 The Commissioner . Data Protection Act 1998 (c. 29) 3 Part II – Rights of data subjects and others Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes F1 PART II RIGHTS OF DATA SUBJECTS AND OTHERS 7 Right of access to personal data. 8 Provisions supplementary to section 7. 9 Application of section 7 where data controller is credit reference agency. 9A Unstructured personal data held by public authorities. 10 Right to prevent processing likely to cause damage or distress. 11 Right to prevent processing for purposes of direct marketing. 12 Rights in relation to automated decision-taking. 12A Rights of data subjects in relation to exempt manual data. 13 Compensation for failure to comply with certain requirements. 14 Rectification, blocking, erasure and destruction. 15 Jurisdiction and procedure. 4 Data Protection Act 1998 (c. 29) Part III – Notification by data controllers Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes F1 PART III NOTIFICATION BY DATA CONTROLLERS 16 Preliminary. 17 Prohibition on processing without registration. 18 Notification by data controllers. 19 Register of notifications. 20 Duty to notify changes. 21 Offences. 22 Preliminary assessment by Commissioner. 23 Power to make provision for appointment of data protection supervisors. 24 Duty of certain data controllers to make certain information available. 25 Functions of Commissioner in relation to making of notification regulations. 26 Fees regulations. Data Protection Act 1998 (c. 29) 5 Part IV – Exemptions Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes F1 PART IV EXEMPTIONS 27 Preliminary. 28 National security. 29 Crime and taxation. 30 Health, education and social work. 31 Regulatory activity. 32 Journalism, literature and art. 33 Research, history and statistics. 33A Manual data held by public authorities. 34 Information available to the public by or under enactment. 35 Disclosures required by law or made in connection with legal proceedings etc. 35A Parliamentary privilege. 36 Domestic purposes. 6 Data Protection Act 1998 (c. 29) Part V – Enforcement Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes 37 Miscellaneous exemptions. 38 Powers to make further exemptions by order. 39 Transitional relief. F1 PART V ENFORCEMENT 40 Enforcement notices. 41 Cancellation of enforcement notice. 41A Assessment notices . 41B Assessment notices: limitations . 41C Code of practice about assessment notices . 42 Request for assessment. 43 Information notices. 44 Special information notices. Data Protection Act 1998 (c. 29) 7 Part VI – Miscellaneous and General Document Generated: 2021-08-03 Changes to legislation: Data Protection Act 1998 is up to date with all changes known to be in force on or before 03 August 2021. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations. (See end of Document for details) View outstanding changes 45 Determination by Commissioner as to the special purposes. 46 Restriction on enforcement in case of processing for the special purposes. 47 Failure to comply with notice. 48 Rights of appeal. 49 Determination of appeals. 50 Powers of entry and inspection. PART VI MISCELLANEOUS AND GENERAL Modifications etc. (not altering text) C4 Pt. VI applied (with modifications) (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 51(1)(b) F1 Functions of Commissioner 51 General duties of Commissioner. 52 Reports and codes of practice to be laid before Parliament. 52A Data-sharing code .